Kerberos Constrained Delegation For Access To A Single Application Pool

Is there some way to configure a service account used to run an ASP.NET
application pool to delegate identity only to specific virtual
directories or application pools on a remote server?

From what I've read, I've only ever seen constaining delegation down to
the HTTP service on a web service. This is insufficient for our
scenarios because we have many applications that run in various farms
and want to control access between specific applications.

For example:

- 2 Web Servers
- Server 1 Has Web Services: A & B
- Server 2 Has Web Services: C & D
- Web Service A should be able to delegate identity to web service C,
but not D
- Web Service B should be able to delegate identity to web service D,
but not C
- A & B Can Run as separate service accounts

How do I restrict access from the various service accounts to only
specific virtual directories or application pools on a server?
Possible?

Thanks!

.

Relevant Pages

  • Re: Kerberos Constrained Delegation For Access To A Single Application Pool
    ... When you say delegate identity, ... across pool A and C but not B and D. ... Server 1 Has Web Services: ... Web Service A should be able to delegate identity to web service C, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Kerberos Constrained Delegation For Access To Single Application P
    ... You will need to setup a unique FQDN for the resources in question (provided ... application pool to delegate identity only to specific virtual directories ... HTTP service on a web service. ... Server 1 Has Web Services: ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Kerberos Constrained Delegation For Access To Single Application P
    ... When you configure different worker process accounts for each application you can register a SPN for every application - but you need separate DNS names ... Server 1 Has Web Services: ... Web Service A should be able to delegate identity to web service C, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Web Service Implementation Security Question
    ... Server was unable to process ... CompilerParameters parameters, Assembly assembly, Hashtable assemblies) at ... > As for the security problems regarding on using TypedDAtaset in asp.net ... Web Service Implementation Security Question ...
    (microsoft.public.inetserver.iis.security)
  • Re: Permission Errors
    ... >a domain account so that it can be validated on the win2k server machine. ... However I have discovered that I can deploy the web service to the W2K ... domain server and there it runs with no problems, ... for me to decide that the new XP dev machine is up and usable. ...
    (microsoft.public.dotnet.general)